HTTP Probing Configuration by crowdsecurity | CrowdSec Hub

HTTP Probing

Attack scenariohttp:scanMITRE T1595

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/http-probing
Remediation: Ban

Detect site scanning/probing from a single ip

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/aws-cloudfront

Installs 2 parsers and 47 scenarios, via HTTP - Generic Protection.

View AWS CloudFront →

Installation

sudo cscli scenarios install crowdsecurity/http-probing

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-probing.yaml· 21 linesGitHub

1# 404 scan
2type: leaky1
3#debug: true
4name: crowdsecurity/http-probing
5description: "Detect site scanning/probing from a single ip"
6filter: "evt.Meta.service == 'http' && evt.Meta.http_status in ['404', '403', '400'] && evt.Parsed.static_ressource == 'false'"2
7groupby: "evt.Meta.source_ip + '/' + evt.Parsed.target_fqdn"3
8distinct: "evt.Meta.http_path"4
9capacity: 105
10reprocess: true
11leakspeed: "10s"6
12blackhole: 5m7
13labels:
14  remediation: true8
15  classification:9
16    - attack.T1595
17  behavior: "http:scan"
18  label: "HTTP Probing"
19  spoofable: 0
20  service: http
21  confidence: 1

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Take remediation against a single IP that requires multiple different (http path) pages that end up in 404/403/400.

Leakspeed of 10s, capacity of 10.